github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: hda: Fix potential UAF for gating jack

Browse Source 
snd_hda_jack_set_gating_jack() assigns gated and gating variables from
the succeeding calls of snd_hda_jack_tbl_get().  This works normally,
but the second call might kick off the reallocation of the jack table,
hence the first pointer might become invalid, which leads to a UAF.

For avoiding that pitfall, this patch changes the code to two phases:
the first to only create two entries, and the second phase to get the
pointers from the table, so that no relocation can happen any longer.

Fixes: 0619ba8c17 ("ALSA: hda - Allow jack state to depend on another jack")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20261007172051.13240-4-tiwai@suse.de
This commit is contained in:
Takashi Iwai 2026-10-07 19:20:39 +02:00
parent c0a10d0e0e
commit 27cee4141c
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sound/hda/common/jack.c
View File

@ -389,12 +389,15 @@ EXPORT_SYMBOL_GPL(snd_hda_jack_detect_enable);
int snd_hda_jack_set_gating_jack(struct hda_codec *codec, hda_nid_t gated_nid,
hda_nid_t gating_nid)
{
struct hda_jack_tbl *gated = snd_hda_jack_tbl_new(codec, gated_nid, 0);
struct hda_jack_tbl *gating =
snd_hda_jack_tbl_new(codec, gating_nid, 0);
struct hda_jack_tbl *gated, *gating;
WARN_ON(codec->dp_mst);
if (!snd_hda_jack_tbl_new(codec, gated_nid, 0) ||
!snd_hda_jack_tbl_new(codec, gating_nid, 0))
return -ENOMEM;
gated = snd_hda_jack_tbl_get_mst(codec, gated_nid, 0);
gating = snd_hda_jack_tbl_get_mst(codec, gating_nid, 0);
if (!gated || !gating)
return -EINVAL;